Wireshark · Ethereal-dev: Re: [Ethereal-dev] Dissection of file data in Write AndX Request message

[Tim Potter <tpot@xxxxxxxxx>]

On Tue, Dec 03, 2002 at 08:01:04PM -0800, Guy Harris wrote:

> I *suspect* the problem is that it's expecting the first part of a DCE
> RPC-over-SMB call to be in an Transaction SMB; however, in this case we
> have:

>From memory, a RPC is only sent using a writeX if it is over a certain
size (1000 bytes or so?) so seeing a 196 byte RPC payload being sent is
a bit strange.

I'd have to look in luke's book to make sure though.


Tim.